{ config, pkgs, inputs, ... }:

{
  imports = with inputs.self.modules; [
    ./hardware-configuration.nix

    domains."bad.net.ru"
    # domains."badbayan.duckdns.org"
    domains."badbayan.ygg"
    # domains."notbad.dynv6.net"

    users.aya
    users.nixbuilder
  ];

  roles.desktop = "gnome";

  boot = {
    extraModulePackages = with config.boot.kernelPackages; [
      ddcci-driver
    ];
    loader = {
      systemd-boot.enable = true;
      timeout = 0;
    };
    kernel.sysctl."kernel.sysrq" = 1;
    kernelModules = [ "ddcci_backlight" ];
    kernelPackages = pkgs.linuxPackages_6_12;
    kernelParams = [ "acpi_backlight=vendor" "tsc=nowatchdog" ];
  };

  services.udev.extraRules = let
    bash = "${pkgs.bash}/bin/bash";
    ddcciDev = "AMDGPU DM i2c hw bus 0";
    ddcciNode = "/sys/bus/i2c/devices/i2c-3/new_device";
  in ''
    SUBSYSTEM=="i2c", ACTION=="add", ATTR{name}=="${ddcciDev}", RUN+="${bash} -c 'sleep 20; printf ddcci\ 0x37 > ${ddcciNode}'"
  '';

  environment.persistence."/system/persist" = {
    directories = [
      "/etc/ssh"
      "/var/db/sudo"
      "/var/lib"
      "/var/log"
      "/var/backup"
    ];
    files = [
      "/etc/machine-id"
    ];
  };

  fileSystems = {
    "/".options = [ "size=1G" "mode=755" ];
    "/etc/ssh" = {
      depends = [ "/system" ];
      neededForBoot = true;
    };
    "/home".options = [ "compress=zstd" ];
    "/nix".options = [ "compress=zstd" "noatime" ];
    "/system" = {
      neededForBoot = true;
      options = [ "compress=zstd" ];
    };
  };

  age.secrets = with inputs.self.modules; {
    yama-wg0.file = secrets.yama-wg0;
    yama-wg0-higan.file = secrets.yama-wg0-higan;
    yama-wg0-makai.file = secrets.yama-wg0-makai;
    yama-wg0-oneplus.file = secrets.yama-wg0-oneplus;
    yama-wg0-blackberry.file = secrets.yama-wg0-blackberry;
    yggdrasil.file = secrets.yggdrasil;
  };

  networking = {
    hostName = "yama";

    dhcpcd = {
      enable = true;
      allowInterfaces = [ "enp*" ];
    };
    networkmanager.enable = false;
    wireless.enable = false;

    interfaces.lo.ipv6.addresses = [{
      address = "304:7039:ade1:9854::bad";
      prefixLength = 64;
    }];

    firewall = {
      allowedUDPPorts = with config.networking.wireguard.interfaces; [
        wg0.listenPort
      ];
      interfaces.wg0.allowedTCPPorts = [ 3389 ];
    };

    wireguard.interfaces = {
      wg0 = {
        ips = [ "10.0.0.1/24" ];
        listenPort = 51820;
        privateKeyFile = config.age.secrets.yama-wg0.path;
        peers = [
          { # higan
            publicKey = "yGMhJqdX8/qeSbmAhfiZpumU4zSu7RmuQOlQORa5hnQ=";
            presharedKeyFile = config.age.secrets.yama-wg0-higan.path;
            allowedIPs = [ "10.0.0.3/32" ];
          }
          # { # makai
          #   publicKey = "kpYFhddhmGiRUwwGqU0hLfRcMRKISB1a29qlRddluCQ=";
          #   presharedKeyFile = config.age.secrets.yama-wg0-makai.path;
          #   allowedIPs = [ "10.0.0.2/32" ];
          # }
          { # OnePlus
            publicKey = "i7tPC3P9xTMK6y6b+UU39Ez/hDd7p75iJchXXKxT/ww=";
            presharedKeyFile = config.age.secrets.yama-wg0-oneplus.path;
            allowedIPs = [ "10.0.0.10/32" ];
          }
          { # blackberry on fail2banana.ru
            publicKey = "WY9o6AZhWGPo3V9QtLVxplhTq1pmzkualEFp0iAmxAo=";
            presharedKeyFile = config.age.secrets.yama-wg0-blackberry.path;
            endpoint = "fail2banana.ru:41820";
            allowedIPs = [ "10.0.0.50/32" ];
            dynamicEndpointRefreshSeconds = 10;
          }
        ];
      };
    };
  };

  virtualisation = {
    containers.enable = true;
    libvirtd.enable = true;
  };

  hardware.bluetooth.input.General.ClassicBondedOnly = false;

  programs = {
    atop.netatop.enable = true;
    steam.enable = true;
  };

  environment.systemPackages = with pkgs; [
    gzdoom
    legendary-gl
    mednafen
    mednaffe
    podman
    qemu
    transmission-remote-gtk
  ];

  systemd.services = {
    sshd = {
      after = [ "network-online.target" "wireguard-wg0.target" ];
      requires = [ "network-online.target" "wireguard-wg0.target" ];
    };
    transmission.serviceConfig.BindPaths = [ "/system/data" ];
  };

  services = {
    # archisteamfarm.enable = true;
    btrfs.autoScrub = {
      enable = true;
      fileSystems = [ "/system" ];
    };
    dnsmasq.enable = true;
    forgejo.dump = {
      enable = true;
      file = "forgejo-dump";
      interval = "22:45";
      type = "tar.zst";
    };
    minidlna = {
      enable = true;
      settings.media_dir = [
        # "A,/system/data/music"
        "V,/system/data/videos"
      ];
    };
    openssh = {
      enable = true;
      listenAddresses = [
        { addr = "192.168.1.10"; }
        { addr = "10.0.0.1"; }
      ];
    };
    postgresql.package = pkgs.postgresql_16;
    postgresqlBackup = {
      enable = true;
      compression = "zstd";
      startAt = "22:45";
    };
    restic.backups.gdrive = {
      exclude = [ "all.prev.sql.zstd" ];
      initialize = true;
      passwordFile = "/system/persist/secrets/restic-password";
      paths = [
        config.services.forgejo.dump.backupDir
        config.services.postgresqlBackup.location
      ];
      pruneOpts = [ "--keep-last 14" ];
      rcloneConfigFile = "/system/persist/secrets/rclone.conf";
      repository = "rclone:gdrive:/backups";
      timerConfig = {
        OnCalendar = "23:00";
        Persistent = true;
      };
    };
    transmission = {
      enable = true;
      group = "users";
      inherit (config.users.users.aya) home;
      openPeerPorts = true;
      settings = {
        incomplete-dir = config.services.transmission.settings.download-dir;
        incomplete-dir-enabled = false;
        peer-limit-global = 500;
        peer-limit-per-torrent = 100;
        speed-limit-up = 9600;
        speed-limit-up-enabled = true;
        umask = 18;
        watch-dir = config.services.transmission.settings.download-dir;
      };
      user = "aya";
    };
    yggdrasil = {
      enable = true;
      configFile = config.age.secrets.yggdrasil.path;
      persistentKeys = false;
    };
  };

  zramSwap.enable = true;
}
